Betheme

betheme

Vulnerabilities:

15

Last Updated:

March 26, 2026

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2025-10-08
Title
Betheme < 28.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_title'
Fixed in
Fixed in 28.1.7
CVSS
6.4 (medium)
Published
2025-10-06
Title
Betheme < 28.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 28.2.1
CVSS
6.4 (medium)
Published
2025-08-05
Title
Betheme < 28.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 28.1.4
CVSS
6.4 (medium)
Published
2025-04-15
Title
Betheme < 28.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 28.0.4
CVSS
6.4 (medium)
Published
2025-01-20
Title
Betheme < 27.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
Fixed in
Fixed in 27.6.2
CVSS
6.4 (medium)
Published
2024-09-12
Title
Betheme | Responsive Multipurpose WordPress & WooCommerce Theme < 27.5.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File
Fixed in
Fixed in 27.5.6
CVSS
6.4 (medium)
Published
2024-08-29
Title
Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
No known fix
CVSS
6.4 (medium)
Published
2024-08-29
Title
Betheme < 27.5.7 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 27.5.7
CVSS
8.8 (high)
Published
2023-11-14
Title
Betheme < 27.1.2 - Missing Authorization
Fixed in
Fixed in 27.1.2
CVSS
6.3 (medium)
Published
2023-04-13
Title
Betheme < 26.8 - Reflected XSS
Fixed in
Fixed in 26.8
CVSS
7.1 (high)
Published
2022-11-22
Title
BeTheme < 26.6.3 - Subscriber+ Stored XSS
Fixed in
Fixed in 26.6.3
CVSS
5.4 (medium)
Published
2022-11-21
Title
Betheme < 26.6 - Contributor+ PHP Object Injection
Fixed in
Fixed in 26.6
CVSS
5.0 (medium)
Published
2022-11-21
Title
Betheme < 26.6.3 - Subscriber+ Unauthorised Action
Fixed in
Fixed in 26.6.3
CVSS
4.3 (medium)
Published
2022-11-21
Title
Betheme < 26.6.3 - Missing Authorization
Fixed in
Fixed in 26.6.3
CVSS
8.1 (high)
Published
2022-11-17
Title
Betheme < 26.6 - Subscriber+ PHP Object Injection
Fixed in
Fixed in 26.6
CVSS
5.0 (medium)